What to Expect in the First 90 Days of Cyber Security Services: Onboarding, Scoping and Reporting Explained

Cyber security services start with a lot of questions and very few visible results, which is why many businesses feel unsure around week three. Nothing seems to be happening.

In reality, the first 90 days are mostly groundwork, and they set the pattern for everything that follows. Here is what a typical engagement looks like, and what you need to do on your side.

Days 1–30: Scoping and access

The first month is about agreeing what the provider will protect. That sounds obvious, but vague scope is the most common reason gaps appear later.

A cloud account, a vendor-managed server or staff laptops used from home can easily fall outside what was agreed.

Expect the provider to ask for:

• A network diagram, even a rough one

• A list of servers, cloud accounts and business applications

• Admin accounts and who holds them

• Details of past incidents or near misses

• Named contacts for escalation, including an out-of-hours number

Write down what is out of scope as well. If the provider does not monitor your email platform, you should know that on day one, not during an incident.

A good kickoff meeting also settles who approves changes, who gets called first and how urgent issues are separated from routine ones.

Early on, the provider will usually run a baseline assessment, such as a vulnerability scan and a review of user accounts and backups. This gives a starting point, so later progress can be measured.

Days 31–60: Tuning and first findings

Monitoring tools do not work perfectly out of the box. In the second month, alerts are tuned: false alarms are filtered out, and the provider learns what normal activity looks like in your environment. Expect some noise at first. If you receive hundreds of unexplained alerts with no priority, ask how tuning is going.

This is also when the first findings arrive. The most useful ones are quick fixes that reduce risk without a big project: turning on multi-factor authentication, applying overdue patches, removing accounts of former staff and checking that backups can actually be restored. Good cyber security services should explain each finding in plain language, say how serious it is and suggest who should fix it.

Ask for agreed response times in writing, then compare them with how the first real alerts were handled.

Days 61–90: Reporting and a first test

By the third month, reporting should settle into a regular rhythm, often monthly. A report worth reading includes:

• A short plain-language summary for management

• Findings ranked by risk, not listed in the order the tool produced them

• What was fixed since the last report and what is still open, with an owner for each item

• Alert trends, including incidents handled and how long they took

A report that is only raw tool output is a warning sign. It shows activity, but it does not help anyone decide what to do next.

Many providers also run a tabletop exercise around this point. This is a walk-through of a made-up incident, such as ransomware on a file server, where everyone says what they would do. It shows whether contact lists are current and whether staff know who can approve shutting a system down.

Use the 90-day mark to review the scope itself. New offices, tools or vendors added during the quarter may need to be brought in.

Mistakes that slow things down

Most delays come from the business side, not the provider. Three patterns show up often:

• Access takes weeks to arrive because nobody owns the request

• Only the IT team is involved, while finance, HR and operations hold sensitive data the provider never hears about

• Staff are not told monitoring has started, so unusual alerts get blamed on the provider instead of being investigated together

Fixing these early costs little. Fixing them during an incident does not.

By day 90, cyber security services should have delivered three things: a scope everyone understands, monitoring tuned to your environment, and a report that management can read without a translator. If any of the three is missing, raise it now. It is far easier to correct courses in the first quarter than after a year of unclear reporting.

If you are comparing providers and want help defining scope, access and reporting before you sign, Trustnet Consultancy LLP, a Kolkata-based technology consultancy, can talk you through protecting your network and systems.